17029 matches found
Advisory ROSA-SA-2025-2920
software: freerdp 2.11.7 OS: ROSA-CHROME unaffected versions = freerdp-2.11.7-7 affected versions freerdp-2.11.7-7 CVE-ID: CVE-2024-32661 BDU-ID: 2024-03394 CVE-Crit: HIGH CVE-DESC.: A vulnerability in the FreeRDP RDP client is related to null pointer dereferencing. Exploitation of the...
Advisory ROSA-SA-2025-2913
software: c-ares 1.19.1 OS: ROSA-CHROME unaffected versions = c-ares-1.19.1-2 affected versions c-ares-1.19.1-2 CVE-ID: CVE-2024-25629 BDU-ID: 2024-01708 CVE-Crit: MEDIUM CVE-DESC.: A vulnerability in the aresreadline function of the C-ares asynchronous DNS query library is related to an operatio...
MAL-2025-6748 Malicious code in pexels-core-sdk (npm)
The package communicates with a domain associated with malicious activity...
CVE-2025-54349
In iperf before 3.19.1, iperfauth.c has an off-by-one error and resultant heap-based buffer overflow...
PT-2025-31766 · Unknown · Mocca Calendar
Name of the Vulnerable Software and Affected Versions: Mocca Calendar versions prior to 2.15 Description: The Mocca Calendar application is susceptible to a cross-site scripting XSS issue. This occurs through a specially crafted title during calendar import. Recommendations: Update Mocca Calendar...
CVE-2025-54351
In iperf before 3.19.1, net.c has a buffer overflow when --skip-rx-copy is used for MSGTRUNC in recv...
CVE-2025-54350
In iperf before 3.19.1, iperfauth.c has a Base64Decode assertion failure and application exit upon a malformed authentication attempt...
CVE-2025-23290
CVE-2025-23290 affects NVIDIA vGPU software and its Virtual GPU Manager. A vulnerability in the Virtual GPU Manager could let a guest VM read global GPU metrics influenced by other VMs, leading to information disclosure. The Red Hat/NVD/NVIDIA advisories confirm the issue and list affected compon...
CVE-2025-6077 CVE-2025-6077
Partner Software's Partner Software Product and corresponding Partner Web application use the same default username and password for the administrator account across all versions...
CVE-2025-54790
Files is a module for managing files inside spaces and user profiles. In versions 0.16.9 and below, Files does not have logic to prevent the exploitation of backend SQL queries without direct output, potentially allowing unauthorized data access. This is fixed in version 0.16.10...
PT-2025-31738 · WordPress · Brave Conversion Engine
Name of the Vulnerable Software and Affected Versions: Brave Conversion Engine PRO plugin for WordPress versions through 0.7.7 Description: The Brave Conversion Engine PRO plugin for WordPress is susceptible to authentication bypass due to improper restriction of a claimed identity during Faceboo...
CVE-2025-54789 Files is Vulnerable to Reflected Self-XSS through its File Move Functionality
Files is a module for managing files inside spaces and user profiles. In versions 0.16.9 and below, the File Move functionality does not contain logic that prevents injection of arbitrary JavaScript, which can lead to Browser JS code execution in the context of the user’s session. This is fixed i...
CVE-2025-54136 Cursor's Modification of MCP Server Definitions Bypasses Manual Re-approvals
Cursor is a code editor built for programming with AI. In versions 1.2.4 and below, attackers can achieve remote and persistent code execution by modifying an already trusted MCP configuration file inside a shared GitHub repository or editing the file locally on the target's machine. Once a...
CVE-2025-54424 1Panel Agent Bypasses Certificate Verification Leading to Arbitrary Command Execution
1Panel is a web interface and MCP Server that manages websites, files, containers, databases, and LLMs on a Linux server. In versions 2.0.5 and below, the HTTPS protocol used for communication between the Core and Agent endpoints has incomplete certificate verification during certificate...
Hashicorp Vault has Lockout Feature Authentication Bypass
Vault and Vault Enterprise’s “Vault” user lockout feature could be bypassed for Userpass and LDAP authentication methods. Fixed in Vault Community Edition 1.20.1 and Vault Enterprise 1.20.1, 1.19.7, 1.18.12, and 1.16.23...
GHSA-QV3P-FMV3-9HWW Hashicorp Vault's TOTP Secrets Engine Susceptible to Code Reuse
Vault and Vault Enterprise’s “Vault” TOTP Secrets Engine code validation endpoint is susceptible to code reuse within its validity period. Fixed in Vault Community Edition 1.20.1 and Vault Enterprise 1.20.1, 1.19.7, 1.18.12, and 1.16.23...
CVE-2025-53009 MaterialX Stack Overflow via Lack of MTLX XML Parsing Recursion Limit
MaterialX is an open standard for the exchange of rich material and look-development content across applications and renderers. In versions 1.39.2 and below, when parsing an MTLX file with multiple nested nodegraph implementations, the MaterialX XML parsing logic can potentially crash due to stac...
GLPI Permission License and Access Control Issues Vulnerability
GLPI is an open source IT asset and service management software suite that provides ITIL service desk functionality, license tracking and software auditing capabilities. A security vulnerability exists in GLPI versions 0.65 through 10.0.18, which originates from a technician being able to utilize...
CVE-2025-53399
In Sipwise rtpengine before 13.4.1.1, an origin-validation error in the endpoint-learning logic of the media-relay core allows remote attackers to inject or intercept RTP/SRTP media streams via RTP packets except when the relay is configured for strict source and learning disabled. Version 13.4.1...